Listen to this Post
How the CVE Works
The vulnerability in CodeIgniter4 v4.6.0 allowed stored XSS attacks via the `debugbar_time` parameter. Attackers could inject malicious JavaScript or HTML payloads into this parameter, which would then be executed when the debug bar was rendered. This could lead to session hijacking, defacement, or other client-side attacks. The issue arose due to insufficient input sanitization in the debug toolbar component.
DailyCVE Form
Platform: CodeIgniter4
Version: v4.6.0
Vulnerability: Stored XSS
Severity: Moderate
Date: Jul 25, 2025
Prediction: Patch withdrawn
What Undercode Say
grep -r "debugbar_time" /var/www/codeigniter4/ curl -X POST -d "debugbar_time=<script>alert(1)</script>" http://target/debug
How Exploit
1. Craft malicious payload: ``
2. Inject into `debugbar_time` parameter.
3. Trigger debug bar rendering.
Protection from this CVE
- Update CodeIgniter4.
- Disable debug mode.
- Sanitize debug inputs.
Impact
- Session hijacking.
- Unauthorized actions.
- Data theft.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
